Splunk Search

Is it possible to use the same subsearch twice in a search?

pduflot
Path Finder

Hello,

Is it possible to use the same subsearch twice in a search? Of course without having Splunk to execute the search twice, but having it caching the results.

0 Karma
1 Solution

inventsekar
Super Champion

i think, its possible to use the same subsearch twice in a query.
also, the limits.conf has a parameter "ttl" - Time to cache a given subsearch's results, in seconds, default value 300 seconds.

https://docs.splunk.com/Documentation/Splunk/6.4.2/Search/Aboutsubsearches
on Splunk Enterprise, limits.conf
[subsearch]
maxout =

Maximum number of results to return from a subsearch.
This value cannot be greater than or equal to 10500.
Defaults to 10000.
maxtime =

Maximum number of seconds to run a subsearch before finalizing
Defaults to 60.
ttl =

Time to cache a given subsearch's results, in seconds.
Do not set this below 120 seconds.
Defaults to 300.

View solution in original post

inventsekar
Super Champion

i think, its possible to use the same subsearch twice in a query.
also, the limits.conf has a parameter "ttl" - Time to cache a given subsearch's results, in seconds, default value 300 seconds.

https://docs.splunk.com/Documentation/Splunk/6.4.2/Search/Aboutsubsearches
on Splunk Enterprise, limits.conf
[subsearch]
maxout =

Maximum number of results to return from a subsearch.
This value cannot be greater than or equal to 10500.
Defaults to 10000.
maxtime =

Maximum number of seconds to run a subsearch before finalizing
Defaults to 60.
ttl =

Time to cache a given subsearch's results, in seconds.
Do not set this below 120 seconds.
Defaults to 300.

View solution in original post

.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!